Method and device for configuring a network device

TECHNICAL FIELD

p-0002The present invention relates to a method and a device for configuring a network device. It further relates to a computer program product enabling a method for configuring a network device. It also relates to a system for processing network traffic and exporting network flow information.

BACKGROUND OF THE INVENTION

p-0003An important task when operating a network is to forward and distribute data, as for example performed by routers, NATs (network address translators) and switches. Such and similar devices, referred to as network devices hereinafter, can be separate hardware entities or can be dedicated general purpose computers.

p-0004Network devices are often designed to export information on the network traffic they process. Such information can, for example, be used for billing purposes or to monitor traffic for load balancing or to detect malicious traffic, e.g. a denial of service attack. Network traffic usually consists of data packets, several of which make up a data entity, for example a data file. A single transaction might comprise a plurality of data entities to be exchanged between two or more units within the network, for example servers as data sources and clients as destinations. Information on network traffic can be presented on many different levels, for example on the packet level or the transaction level. Information on the packet level can usually be acquired from a Management Information Base (MIB) maintained by the network device. A system for monitoring the performance of a network based on information contained in MIBs is for example disclosed in US 2004/0054680 A1.

p-0005A commonly used level for presenting information on network traffic that allows a deeper and more sophisticated analysis of the network traffic is based on network flows. A network flow may be defined as a unidirectional stream of packets from a certain source to a certain destination. A commonly used data format in which network flow information can be exported is defined by Cisco's flow profiling system NetFlow, as for example described in the manual “Cisco IOS Release 12.0 (5) T”. An open, general and flexible standard called IPFIX (Internet Protocol Flow Information eXport) is being standardized by an IETF (Internet Engineering Task Force) workgroup.

p-0006For a network device to be able to export information on network traffic based on network flows, the network device usually keeps track of flows using a flow state table, sometimes also called flow table or flow cache. Each flow is represented by an entry in the flow state table, where, for example, the number of transmitted packets or transmitted bytes belonging to each flow is recorded. Upon detection of a packet stating a termination of the flow or after a certain period of time has run out, the flow information is exported and subsequently the entry deleted from the flow state table.

p-0007Problems can occur under increasing traffic load. As a result of increasing traffic load the flow state table might become so large that updating the flow state table might negatively affect the network devices' performance for processing network traffic. To reduce this effect, an associative memory device can be used to identify network flow information and maintain the flow state table as disclosed by U.S. Pat. No. 6,871,265 B1. Under more traffic, the flow state table might further exceed its maximum capacity so that no further flow information can be gathered. Also, the number of exported netflows can get so high that the additional network traffic negatively affects the network performance.

p-0008According, for example, to Cisco's NetFlow system, a solution to this problem is to statistically sample or filter incoming packets to decrease the number of packets considered in the flow state table. Another solution is to use a wider, more general definition of what constitutes a network flow in order to aggregate information. Sampling, filtering and aggregation policies are used to manually configure network devices to utilize one of these or a combination of these techniques. U.S. Pat. No. 6,446,200 B1 and U.S. Pat. No. 6,751,663 B1 disclose a system in which a data collector layer receives network flow information from network devices and sends it to a flow aggregation layer that aggregates received records and stores the aggregated information. That way, aggregation can be performed on packets processed by different network devices, which reduces the amount of finally stored aggregated information even more than aggregation performed in each network device, but does not reduce network traffic due to the transmission of network flow information from the data collector layer to the flow aggregation layer. A drawback of all mentioned techniques is that they might compromise fidelity of the network flow information, in particular if not well tuned to the actual kind of network traffic.

p-0009It is therefore a challenge to provide a method, a device and a computer program product for configuring a network flow information exporting device to export network flow information with better fidelity and in a less resource-intensive manner. It is further a challenge to provide a system for processing network traffic and exporting network flow information more effectively.

SUMMARY OF THE INVENTION

p-0010According to one aspect of the invention, a method for configuring a network device is provided. The network device is adapted to process network traffic comprising a plurality of network flows, the network device is further adapted to export network flow information. The method comprises the following steps. A copy of the network traffic being processed by the network device is created. A simulation of a process of collecting the network flow information using the copy of the network traffic is performed. Based on the results of the simulation, a preferred information collection scheme is determined. The network device is then configured to collect the network flow information to be exported according to the preferred information collection scheme. The simulation finds the preferred information collection scheme to be used by the network device that provides a higher level of fidelity of the network flow information in a less resource-intensive manner. Configuration of the network device is performed automatically and continuously according to the actual traffic. The method is therefore better suited to be used within an autonomic computing architecture that is self-configuring and self-optimizing. By performing an analysis on the process of collecting the network flow information, off-line burdening of the network device with additional computing tasks is reduced.

p-0011In a preferred embodiment of the method, the step of performing the simulation comprises a step of determining parameters of the process of collecting the network flow information for a set of at least two different information collection schemes, followed by a step of determining the preferred information collection scheme to be one of the information collection schemes of the set dependent on the determined parameters. This way, quantities of the process of collecting the network flow information can be taken into account when selecting the preferred information collection scheme. In a further preferred embodiment of the method, the determined parameters comprise a usage of memory while collecting network flow information. This way, the probability of an overflow of the network device's memory resources can be reduced.

p-0012In another embodiment of the method, the step of performing the simulation comprises a step of determining parameters of the network flow information to be exported for a set of at least two different information collection schemes, followed by a step of determining the preferred information collection scheme to be one of the information collection schemes of the set dependent on the determined parameters. This way, quantities of the process of exporting network flow information can be taken into account when selecting the preferred information collection scheme. In a further preferred embodiment of the method, the determined parameters comprise an amount of network traffic arising from an export of the network flow information. This way, a creation of additional network traffic due to the network flow information that imposes on the network's performance can be reduced.

p-0013In a further preferred embodiment of the method, the step of performing the simulation comprises a determination of a simulated flow state table, resembling a flow state table of the network device. Collecting network flow information by means of a flow state table is commonly used by network devices. Using a similar data structure in the simulation ensures that results of the simulation are better representative of the operation of the network device.

p-0014In further preferred embodiments of the method, the information collection schemes comprise an aggregation policy, the aggregation policy comprising instructions for aggregating information on the network traffic to determine the network flow information, and/or a sampling policy, the sampling policy comprising instructions for sampling information prior to a determination of the network flow information and/or a filtering policy, the filtering policy comprising instructions for filtering the network traffic prior to the determination of the network flow information. These ways, aggregation, sampling and/or filtering, which are preferable methods to reduce the amount of data when exporting network flow information, can be advantageously used and eventually also be combined by the method.

p-0015According to a second aspect of the invention, a configuration device for configuring a network device is provided. The network device is adapted to process network traffic comprising a plurality of network flows and is further adapted to export network flow information. The configuration device is adapted to receive a copy of the network traffic being processed by the network device and to perform a simulation of a process of collecting the network flow information using the copy of the network traffic. It is further adapted to determine a preferred information collection scheme based on the simulation and to configure the network device to collect the network flow information to be exported according to the preferred information collection scheme.

p-0016According to a third aspect of the invention, a system for processing network traffic and exporting network flow information is provided. The system comprises a network device that is adapted to process network traffic comprising a plurality of network flows and to export network flow information. The system further comprises a configuration device as described above and a traffic mirror that is adapted to create a copy of the network traffic being processed by the network device and send the copy to the configuration device.

p-0017According to a fourth aspect of the invention, a computer program product comprising a computer-readable medium embodying program instructions executable by a processor to perform a method as described above is provided.

p-0018The advantages of the second, third and fourth aspect of the invention correspond to the advantages of the first aspect of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

p-0019The invention and its embodiments will be more fully appreciated by reference to the following detailed description of presently preferred but nonetheless illustrative embodiments in accordance with the present invention when taken in conjunction with the accompanying drawings.

p-0020The figures are illustrating:

p-0021<figref idrefs="DRAWINGS">FIG. 1</figref>, a schematic diagram of a system for processing network traffic and exporting network flow information, and

p-0022<figref idrefs="DRAWINGS">FIG. 2</figref>, a flowchart of a method for configuring a network device.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

p-0023<figref idrefs="DRAWINGS">FIG. 1</figref> shows an embodiment of a system for processing network traffic and for exporting network flow information. It comprises a network device <b>1</b> with a plurality of network connections to process network traffic <b>2</b>. Data being transmitted by the network, making up the network traffic <b>2</b>, is packed to form data packets <b>3</b>, DP<b>1</b>-DPn, several of which can make up a network flow <b>4</b>, NF<b>1</b>-NFn. The network device <b>1</b> is adapted to export information on the network flows <b>4</b> being processed by the network device <b>1</b> as network flow information <b>5</b>. A traffic mirror <b>6</b> is present to create a copy <b>7</b> of the network traffic <b>2</b>. The traffic mirror <b>6</b> is connected to a configuration device <b>8</b> that receives the copy <b>7</b> of the network traffic <b>2</b>. The configuration device <b>8</b> comprises a simulated flow state table <b>9</b> and a set <b>10</b> of information collection schemes, IC<b>1</b>-ICn. The configuration device <b>8</b> is connected to the network device <b>1</b> and is adapted to send a preferred information collection scheme ICSp <b>11</b> that may comprise an aggregation policy AP <b>12</b> and/or a sampling policy SP <b>13</b>. The network device <b>1</b> contains a flow state table <b>14</b> from which the network flow information <b>5</b> is being extracted. The flow state table <b>14</b> is managed by the network device <b>1</b> according to the preferred information collection scheme <b>11</b>.

p-0024By way of example, the network device <b>1</b> shown in the system of <figref idrefs="DRAWINGS">FIG. 1</figref> is a router, used to distribute the network traffic <b>2</b> between an incoming network connection (on the left hand side of <figref idrefs="DRAWINGS">FIG. 1</figref>) and several outgoing network connections (right hand side of <figref idrefs="DRAWINGS">FIG. 1</figref>).

p-0025The transmission of the network traffic <b>2</b> in the form of the data packets <b>3</b> is a method used by a plurality of internet protocols. Each data packet <b>3</b> is equipped with a header carrying information used for correct delivery of the data packet <b>3</b>, such information comprising e.g. destination IP (internet protocol) address, source IP address, port numbers, protocol type and also additional information, for example on the type of service.

p-0026The data packets <b>3</b> can be grouped to form the network flows <b>4</b> according to the information stored in the header of the data packets <b>3</b>. In one possible definition, network flows <b>4</b> are unidirectional streams of data packets <b>3</b> having the same source and destination IP addresses, using the same protocol and referring to the same type of service. This is only one possible definition of the network flows <b>4</b>. In fact, the technique of aggregation which will be described in more detail herein, is based on the usage of different definitions on what constitutes network flows <b>4</b>.

p-0027When processed by the network device <b>1</b>, the header of the data packet <b>3</b> is being analyzed. The flow state table <b>14</b> managed by the network device <b>1</b> has entries for the network flows <b>4</b> being currently processed, which will be referred to as “open entries” hereinafter. In each open entry of the flow state table <b>14</b>, information on the respective network flow <b>4</b> is stored, for example the number of data packets <b>3</b> belonging to the network flow <b>4</b> and processed so far or the number of bytes contained in these data packets <b>3</b>.

p-0028If the data packet <b>3</b> currently being processed by the network device <b>1</b> belongs to one of the network flows <b>4</b> with an open entry in the flow state table <b>14</b>, it is taken into account in this entry. If, on the one hand, a data packet <b>3</b> is being processed which states the termination of a network flow <b>4</b>, the open entry of network flow <b>4</b> is closed and the stored information is exported as network flow information <b>5</b>. In addition, entries might be closed after a predetermined time interval has run out, thereby avoiding keeping entries open indefinitely when no terminating data packet <b>3</b> had been or will be received. If, on the other hand, a data packet <b>3</b> is being processed which cannot be assigned to any open entry in the flow state table <b>14</b>, a new entry is created.

p-0029Network flow information <b>5</b> can be exported using the IPFIX or NetFlow format. Network flow information <b>5</b> can be exported using the same network connection as is used for the network traffic <b>2</b>, even if a separate connection is shown in <figref idrefs="DRAWINGS">FIG. 1</figref> for exporting the network flow information <b>5</b>.

p-0030Increasing traffic can lead to an increasing number of open entries, bearing the danger of exceeding the maximum storage capacity available for the flow state table <b>14</b>. Also, the amount of computing power used for bookkeeping of the larger flow state table <b>14</b> will increase with the number of its open entries. The network device <b>1</b> is therefore adapted to receive the preferred information collection scheme <b>11</b> through which the collection of information on the network flows <b>4</b> can be modified. In the embodiment shown in <figref idrefs="DRAWINGS">FIG. 1</figref>, the techniques of aggregation and/or statistical sampling can be used, defined by the aggregation policy <b>12</b> and the sampling policy <b>13</b>. In other embodiments, filtering can additionally be implemented as a third technique. Aggregation policies <b>12</b>, sampling policy <b>13</b> and/or filtering policies can be transmitted to the network device <b>1</b> using a standard control plane method like SNMP (Simple Network Management Protocol), ForCES (Forwarding and Control Element Separation) or COPS-PR (Common Open Policy Service Usage for Policy Provisioning) in combination with PIBs (Policy Information Bases).

p-0031When sampling, not every data packet <b>3</b> processed by the network device <b>1</b> is taken into account in the flow state table <b>14</b>. For example, through the sampling policy <b>13</b> the network device <b>1</b> could be configured to only take every second data packet <b>3</b> into account. Sampling is statistical in the sense that it does not depend on the header or the content or any other property of the data packet <b>3</b>, but merely on the order of the arrival.

p-0032The technique of filtering is similar to sampling in that not every data packet <b>3</b> is taken into account in the flow state table <b>14</b>. In contrast to sampling, it depends on the data packet <b>3</b> itself, whether or not it is taken into account. For example, a filtering policy could state that data packets <b>3</b> coming from a certain IP source address or a group or a range of IP source addresses are disregarded for the collection of information on the network flows <b>4</b>.

p-0033In contrast to sampling and filtering, all data packets <b>3</b> are taken into account in the flow state table <b>14</b> if the technique of aggregation is used. In aggregation, the definition of what constitutes a network flow <b>4</b> is modified, thereby possibly reducing the number of entries of the flow state table <b>14</b>. For example, through the aggregation policy <b>12</b> the network device <b>1</b> could be configured to subsume under one network flow <b>4</b> all data packets <b>3</b> directed to the same IP destination address and concerning the same type of service, but coming from a range of IP source addresses rather than from a single IP source address. Another example would be to subsume under one network flow <b>4</b> all data packet <b>3</b> coming from the same IP source address, directed to the same IP destination address independent of the type of service.

p-0034Selecting the preferred information collection scheme <b>11</b> that is neither too aggressive concerning information reduction, in which case the fidelity of the network information <b>5</b> is compromised, nor too weak, in which case information reduction is less efficient, is performed by the configuration device <b>7</b>. From the set <b>10</b> of information collection schemes it selects the preferred information collection scheme <b>11</b> and configures the network device <b>1</b> to use the preferred information collection scheme <b>11</b>. The configuration device <b>8</b> uses the copy <b>7</b> of the network traffic <b>2</b> which is generated by the traffic mirror <b>6</b>. Depending on the type of network, the traffic mirror <b>6</b> can, for example, be a splitter or a fiber tab or any other device suitable to duplicate the network traffic <b>2</b>. A program being stored in the configuration device <b>8</b> and being executed in the configuration device <b>8</b> is described now in conjunction with the flow chart of <figref idrefs="DRAWINGS">FIG. 2</figref>.

p-0035In a first group of steps, in a step S<b>1</b> the copy <b>7</b> of network traffic <b>2</b> is received by the configuration device <b>8</b>. As the network traffic <b>2</b> does, the copy <b>7</b> comprises data in the form of data packets <b>3</b>. The data packets <b>3</b> are analyzed and relevant packet information is stored in a step S<b>2</b>. Relevant information may comprise the source IP address, the destination IP address, the type of service and the length of the data packet <b>3</b>, e.g. in bytes; in principle the same information that can also be used to determine network flow information <b>5</b>. The steps S<b>1</b> and S<b>2</b> are repeated continuously in order to keep the stored relevant packet information up-to-date, preferably without missing any data packets <b>3</b>.

p-0036A second group of steps, starting with a step S<b>3</b>, is performed in parallel to the first group of steps. In step S<b>3</b>, a first information collection scheme, out of the set <b>10</b> of information collection schemes is selected. The selection might be random or might depend on formerly selected information collection scheme or might be based on other criteria. Also, the information collection scheme that is currently used by the network device <b>1</b> might be selected to be the first information collection scheme.

p-0037In a step S<b>4</b>, a simulated flow state table <b>9</b> is determined based on the stored relevant packet information according to the first information collection scheme. The simulated flow state table <b>9</b> then resembles the flow state table <b>14</b> of the network device <b>1</b> as it would be under the same conditions, i.e. the network traffic <b>2</b> as stored by the relevant packet information and the aggregation policies <b>12</b> and/or the sampling policies <b>13</b> of the first information collection scheme. The simulated flow state table <b>9</b> is not necessarily an exact copy of how the flow state table <b>14</b> of the network device <b>1</b> would look, since both might have a different data structure. They however both behave similarly, e.g. growing or shrinking in size, when changing from one information collection scheme to another. In step S<b>4</b>, it might also be simulated how many entries of the simulated flow state table <b>9</b> would have been closed in the course of the simulation and would accordingly have been exported as network flow information <b>5</b>.

p-0038In a step S<b>5</b>, results of the simulation are determined and stored. Results can, for example, be the amount of memory used to store the simulated flow state table <b>9</b>, the amount of exported flow information <b>5</b>, or the computational power used for book-keeping of the simulated flow state table <b>9</b>.

p-0039The method may then branch in a step S<b>6</b> to proceed again with step S<b>3</b>, selecting a next information collection scheme out of the set <b>10</b> of information collection schemes. The steps S<b>4</b> and S<b>5</b> are then repeated using the same stored relevant packet information as in the simulation using the first information collection scheme. Additional stored relevant packet information, which might have been collected in the steps <b>1</b> and <b>2</b> performed in the meantime, is ignored for the simulations to be comparable. In an alternative embodiment, the simulation results are made independent of the stored relevant packet information by relating the results to the number of data packets <b>3</b> they are based on. Then even results of simulations performed with different stored relevant packet information can be compared with each other.

p-0040If at least two simulations have been performed, the method may continue with a step S<b>7</b>, in which the results of the simulations performed are evaluated in order to rate the first and next information collection schemes. Evaluation is based on a predetermined set of criteria. Evaluation might comprise a weighting of the memory and computing power usage for book-keeping of the flow state table <b>9</b> and the network traffic <b>2</b> due to the export of network flow information <b>5</b> on the one hand, and information fidelity on the other hand. The evaluation criteria might depend on the purpose the network flow information <b>5</b> is intended to be used for. For example, for billing other criteria might be used than for load-balancing.

p-0041As a result of the evaluation, one of the first or next information collection schemes might be determined to be the preferred information collection scheme <b>11</b> to be used by the network device <b>1</b>. If not already actually used (as determined at step S<b>9</b>), the network device <b>1</b> is configured at step S<b>10</b> to use the preferred information collection scheme <b>11</b> from then on.

p-0042The method may then terminate, but usually it will branch backwards and proceed again with step S<b>3</b>. This way, it is continuously evaluated whether one of the information collection schemes of the set <b>10</b> might lead to a better compromise between fidelity and usage of resources than the one actually used by the network device <b>1</b>. In another embodiment, the configuration device <b>8</b> continuously calculates the simulated flow state table <b>9</b> for the information collection scheme currently used by the network device <b>1</b>. Only if the result of this simulation reveals that the simulated flow state table <b>9</b> becomes too large or the amount of exported flow state information <b>5</b> becomes too high, will alternative information collection schemes be searched for.

p-0043The selection of the first and the next information collection schemes (step S<b>3</b>) can be based on criteria that resemble experience or results of former simulations (“educated guess”). The information collection schemes of the set <b>10</b> can, for example, be ordered according to their data reduction capability. Depending on the result of the simulation for the first, e.g. actual, information collection scheme, the next information collection scheme can be selected considering the expected data reduction capability.

p-0044In another embodiment of the method, the network device can be adapted to export information on the state, e.g. size, of the flow state table <b>14</b> to the configuration device <b>8</b>. The configuration device <b>8</b> can be adapted to use this state information for selecting the preferred information collection scheme <b>11</b> in addition to the results of the simulations. Transmission of state information could be performed using SNMP.

p-0045The method for configuring a network device may be implemented in part or as a whole in software or hardware or a combination thereof. The method may, when implemented in hardware, be performed by a configuration device for configuring a network device. The method may, when implemented in software, be performed by a computer program product. The computer program product may be provided on a non-transitory computer readable medium embodying software instructions executable by a computer to perform the steps of the method. The computer-readable medium may, for example, be a CD-ROM, a DVD, a flash memory card, a hard disk, or any other suitable computer-readable medium, e.g., a storage medium within a network.